Received-SPF: softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19;
Date:   Sat, 28 May 2022 00:03:39 -0600 (MDT)
From:   Nate Eldredge <nate@thatsmathematics.com>
To:     linux-kernel@vger.kernel.org
Subject: PTRACE_GET_SYSCALL_INFO requires PTRACE_O_TRACESYSGOOD but not
 documented
Message-ID: <ddca4058-b356-abfb-12d8-b2357ed7b3e0@thatsmathematics.com>
MIME-Version: 1.0
Content-Type: text/plain; format=flowed; charset=US-ASCII
Precedence: bulk

It seems that the PTRACE_GET_SYSCALL_INFO function of ptrace(2) only works 
properly if the tracer has set the PTRACE_O_TRACESYSGOOD option.  The man 
page doesn't mention this requirement.  Is it intentional?

The issue is that ptrace_get_syscall_info() in kernel/ptrace.c only calls 
the ptrace_get_syscall_info_{entry,exit} functions to fully populate the 
ptrace_syscall_info struct if child->last_siginfo->si_code == SIGTRAP | 
0x80.  And the 0x80 bit is only set when PTRACE_O_TRACESYSGOOD is in 
effect.  Otherwise, the struct always comes back to userspace with op == 
PTRACE_SYSCALL_INFO_NONE and the entry (or exit) member is not filled in 
with the system call arguments (or return value).

-- 
Nate Eldredge
nate@thatsmathematics.com